AWS-Security-Specialty Practice Questions

A.  

In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core.

B.  

In the application, add a client ID check. Disconnect from the server if any special character is detected.

C.  

Apply an AWS IoT Core policy that allows " AWSIoTWirelessDataAccess " with the principal set to " client/${iot:Connection.Thing.ThingName} " .

D.  

Apply an AWS IoT Core policy to the device to allow " iot:Connect " with the resource set to " client/${iot:ClientId} " .

E.  

Apply an AWS IoT Core policy to the device to allow " iot:Connect " with the resource set to " client/${iot:Connection.Thing.ThingName} " .

A.  

Create an AWS PrivateLink endpoint. Specify the existing ALB as the target. Update the CloudFront distribution by setting the PrivateLink endpoint as the origin.

B.  

Create a new internal AL

B.  

Move all the ECS services to the internal AL

B.  

Delete the internet-facing AL

B.  

Update the CloudFront distribution by setting the internal ALB as the origin.

C.  

Modify the listener rules for the existing AL

B.  

Add a condition to forward only the requests that come from IP addresses in the CloudFront origin prefix list.

D.  

Update the CloudFront distribution by adding an X-Shared-Secret custom header for the origin. Modify the listener rules for the existing ALB to forward only the requests in which the X-Shared-Secret header has the correct value.

A.  

Create an AWS PrivateLink endpoint and set it as the CloudFront origin.

B.  

Create a new internal ALB and delete the internet-facing AL

B.  

C.  

Modify the ALB listener rules to allow only CloudFront IP ranges.

D.  

Add a custom X-Shared-Secret header in CloudFront and configure the ALB listener rules to allow requests only when the header value matches.

A.  

Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days.

B.  

Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an S3 event notification to invoke the Lambda function for each PutObject operation.

C.  

Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days. Create an Amazon EventBridge rule to invoke the Lambda function each month.

D.  

Configure S3 Intelligent-Tiering on the S3 bucket to automatically transition objects to another storage class.

A.  

Create security groups that only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the security groups to all the SQS queues in all the VPCs in the organization.

B.  

In all the VPCs in the organization, adjust the network ACLs to only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the network ACLs to all the subnets in all the VPCs in the organization.

C.  

Create interface VPC endpoints for Amazon SQS in all the VPCs in the organization. Set the aws:SourceVpce condition to the VPC endpoint identifier on the SQS policy. Add the aws:PrincipalOrgId condition to the VPC endpoint policy.

D.  

Use a cloud access security broker (CASB) to maintain a list of managed resources. Configure the CASB to check the API and console access against that list on a web proxy.

A.  

AWS Site-to-Site VPN

B.  

AWS Direct Connect

C.  

AWS VPN CloudHub

D.  

VPC peering

E.  

NAT gateway

A.  

Add theaws:sourceVpcecondition to the AWS KMS key policy referencing the company ' s VPC endpoint I

D.  

B.  

Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.

C.  

Create a VPC endpoint for AWS KMS withprivate DNS enabled.

D.  

Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.

E.  

Add the following condition to the AWS KMS key policy: " aws:SourceIp " : " 10.0.0.0/16 " .

A.  

Create one IAM user in the production account. Grant the appropriate permissions to the resources that are needed. Share the password only with the users that need access.

B.  

Create cross-account access with an IAM role in the developer account. Grant the appropriate permissions to this role. Allow users in the developer account to assume this role to access the production resources.

C.  

Create cross-account access with an IAM user account in the production account. Grant the appropriate permissions to this user account. Allow users in the developer account to use this user account to access the production resources.

D.  

Create cross-account access with an IAM role in the production account. Grant the appropriate permissions to this role. Allow users in the developer account to assume this role to access the production resources.

A.  

Disable the IAM user and query CloudTrail logs in Amazon S3 using Athena.

B.  

Remove IAM policies and query logs in Security Hub.

C.  

Remove permission sets and query logs using CloudWatch Logs Insights.

D.  

Disable the user in IAM Identity Center and query the organizational event data store.

A.  

Configure the rule to use theCountaction.

B.  

Configure the rule to use theBlockaction.

C.  

Configure the rule to use theMonitoraction.

D.  

Configure the rule to use theAllowaction.